Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

542new WordPress flaws this week

391,181entries in the database

4,604 results · page 11 of 93

Sep 23, 2026Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.CVE-2026-95527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
Affected
up to 6.2.4
What to do
Affects up to 6.2.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.CVE-2026-95524 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.
Affected
up to 4.3.11
What to do
Affects up to 4.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-95515 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Affected
up to 3.15.3
What to do
Affects up to 3.15.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.CVE-2026-95514 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
Affected
up to 2.10.0
What to do
Affects up to 2.10.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.CVE-2026-95513 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.
Affected
up to 4.6.0
What to do
Affects up to 4.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.CVE-2026-94498 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
Affected
up to 3.15.4
What to do
Affects up to 3.15.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.CVE-2026-94487 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
Affected
up to 2.50.1
What to do
Affects up to 2.50.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.CVE-2026-94457 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
Affected
up to 3.32
What to do
Affects up to 3.32. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.CVE-2026-94179 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Affected
up to 2.4.9
What to do
Affects up to 2.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.CVE-2026-94176 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Affected
up to 2.4.1
What to do
Affects up to 2.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.CVE-2026-94080 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
Affected
up to 2.1.70
What to do
Affects up to 2.1.70. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.CVE-2026-94079 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Affected
up to 2.9.19
What to do
Affects up to 2.9.19. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.CVE-2026-93774 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Affected
up to 9.3.02.002
What to do
Affects up to 9.3.02.002. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.CVE-2026-93623 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Affected
up to 3.7.8
What to do
Affects up to 3.7.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.CVE-2026-93622 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Affected
up to 1.5.9.3
What to do
Affects up to 1.5.9.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.CVE-2026-93620 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Affected
up to 8.2.5
What to do
Affects up to 8.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-93526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Affected
up to 5.29.4
What to do
Affects up to 5.29.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 23, 2026SUMIT Payment Gateway for WooCommerce: Does not verify with the payment provider that a payment notification is genuine before marking the corresponding orderCVE-2026-84091 · WordPress plugins & themes · reported by WPScanMedium 5.3
The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment.
Product
SUMIT Payment Gateway for WooCommerce
Fixed in
4.0.0
What to do
Update SUMIT Payment Gateway for WooCommerce to 4.0.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticatedCVE-2026-87848 · WordPress plugins & themes · reported by WPScanLow 3.7
The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones.
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Premium Packages: Does not verify PayPal's webhook signature before processing payment and subscription notificationsCVE-2026-93511 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know.
Product
Premium Packages
Fixed in
7.2.1
What to do
Update Premium Packages to 7.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Paid Membership Subscriptions: Does not bind one of its unauthenticated payment actions to the requesting userCVE-2026-90951 · WordPress plugins & themes · reported by WPScanLow 3.7
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state.
Product
Paid Membership Subscriptions
Fixed in
3.1.0
What to do
Update Paid Membership Subscriptions to 3.1.0 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Product Badge, Label, Countdown Timer for WooCommerce: Does not check whether a product is published before returning its details to unauthenticated usersCVE-2026-88929 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Product Badge, Label, Countdown Timer for WooCommerce WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products.
Product
Product Badge, Label, Countdown Timer for WooCommerce
Fixed in
7.5.2
What to do
Update Product Badge, Label, Countdown Timer for WooCommerce to 7.5.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Forminator Forms: Does not bind its saved-draft notification to the visitor who created the draftCVE-2026-87074 · WordPress plugins & themes · reported by WPScanLow 3.7
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed without limit.
Product
Forminator Forms
Fixed in
1.57.2.1
What to do
Update Forminator Forms to 1.57.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
Product
Real3D Flipbook
Fixed in
5.4
What to do
Update Real3D Flipbook to 5.4 or newer.
Full record and what to do →NVD record wpscan.com
Sep 23, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favoritesCVE-2026-84150 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Fixed in
8.9.5
What to do
Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to 8.9.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 22, 2026HashBar – WordPress Notification Bar: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-94117 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar – WordPress Notification Bar allows Blind SQL Injection. This issue affects HashBar – WordPress Notification Bar: from n/a through 2.0.3.
Product
HashBar – WordPress Notification Bar
Affected
up to 2.0.3
What to do
Affects up to 2.0.3. Update HashBar – WordPress Notification Bar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Sep 22, 2026Taxi Booking Manager for WooCommerce: Authentication Bypass Using an Alternate Path or ChannelCVE-2026-93928 · WordPress plugins & themes · reported by PatchstackHigh 7.3
Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows Authentication Bypass. This issue affects Taxi Booking Manager for WooCommerce: from n/a before 2.0.8.
Product
Taxi Booking Manager for WooCommerce
Fixed in
2.0.8
What to do
Update Taxi Booking Manager for WooCommerce to 2.0.8 or newer.
Full record and what to do →NVD record patchstack.com
Sep 22, 2026WP User Manager: Unauthorized modification of dataCVE-2026-18345 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
Product
WP User Manager
Affected
up to 2.9.18
What to do
Affects up to 2.9.18. Update WP User Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 22, 2026Handily: Unauthorized payment settings modificationCVE-2025-14487 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configuration settings, including publishable keys, secret keys, email addresses, success URLs, and cancel URLs via the payment settings parameters. This could allow attackers to redirect payments to their own Stripe accounts.
Product
Handily
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Handily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 22, 2026Image Buzz: Unauthorized API key modificationCVE-2025-14484 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify arbitrary API keys (Pixabay, Unsplash, Pixels) configured by site administrators via the 'pixabay_api', 'unsplash_api', or 'pixels_api' parameters.
Product
Image Buzz
Affected
up to 1.0.3
What to do
Affects up to 1.0.3. Update Image Buzz to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 22, 2026CMP – Coming Soon & Maintenance Plugin by NiteoThemes: Unauthorized modification of data that can lead to privilege escalationCVE-2026-12470 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'cmp_ajax_import_settings' AJAX action in all versions up to, and including, 4.1.17. This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Product
CMP – Coming Soon & Maintenance Plugin by NiteoThemes
Affected
up to 4.1.17
What to do
Affects up to 4.1.17. Update CMP – Coming Soon & Maintenance Plugin by NiteoThemes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 21, 2026Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-leveCVE-2026-93339 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
Fixed in
3.1.70
What to do
Update the plugin to 3.1.70 or newer.
Full record and what to do →NVD record lazytitan.ro wordpress.org
Sep 21, 2026Payment Gateway for PayPal on WooCommerce: Does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an oCVE-2026-92400 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order complete, allowing unauthenticated users to mark their own orders as paid using a genuine transaction from a payment sandbox they control.
Product
Payment Gateway for PayPal on WooCommerce
Fixed in
9.2.1
What to do
Update Payment Gateway for PayPal on WooCommerce to 9.2.1 or newer.
Full record and what to do →NVD record wpscan.com
Sep 20, 2026Meow Gallery: Does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpointCVE-2026-92422 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode string that it passes to the WordPress shortcode parser on a publicly reachable endpoint, allowing unauthenticated users to execute arbitrary registered shortcodes and disclose non-public gallery content.
Product
Meow Gallery
Fixed in
5.5.5
What to do
Update Meow Gallery to 5.5.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Payment Gateway of Stripe for WooCommerce: Improper Verification of Cryptographic SignatureCVE-2026-9832 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\Stripe\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations — because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing sec
Product
Payment Gateway of Stripe for WooCommerce
Affected
up to 5.0.8
What to do
Affects up to 5.0.8. Update Payment Gateway of Stripe for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026VW Writer Blog: Unauthorized modification of dataCVE-2026-2278 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_settings' function in all versions up to, and including, 1.3.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset all theme customizer settings to their defaults.
Product
VW Writer Blog
Affected
up to 1.3.8
What to do
Affects up to 1.3.8. Update VW Writer Blog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record themes.trac.wordpress.org themes.trac.wordpress.org
Sep 19, 2026Ibtana – Ecommerce Product Addons: Unauthorized post meta modificationCVE-2026-1984 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_use_gt_editor' AJAX action in all versions up to, and including, 0.4.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update or delete arbitrary post meta entries via the 'iepa_builder' meta key.
Product
Ibtana – Ecommerce Product Addons
Affected
up to 0.4.7.7
What to do
Affects up to 0.4.7.7. Update Ibtana – Ecommerce Product Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Metasync: Unauthorized modification of dataCVE-2026-15947 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings() function in versions up to, and including, 2.6.23. This function is registered on the admin_init hook and only checks for the presence of $_POST['submit'] before writing attacker-supplied $_POST['metasync_post_types'] into the site-wide 'metasync_options_instant_indexing' option via update_option(); no current_user_can()/current_user_has_plugin_access() check and no nonce verification are performed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the site's Google Instant Indexing post-type configuration, controlling which post types are auto-submitted to Google's Instant Indexing service.
Product
Metasync
Affected
up to 2.6.23
What to do
Affects up to 2.6.23. Update Metasync to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026SSL Zen — SSL Certificate Installer & HTTPS Redirects: Reflected Cross-Site ScriptingCVE-2026-15463 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage.
Product
SSL Zen — SSL Certificate Installer & HTTPS Redirects
Affected
up to 4.7.42
What to do
Affects up to 4.7.42. Update SSL Zen — SSL Certificate Installer & HTTPS Redirects to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 19, 2026Online Scheduling and Appointment Booking System: Does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actionsCVE-2026-91847 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.
Product
Online Scheduling and Appointment Booking System
Fixed in
28.2
What to do
Update Online Scheduling and Appointment Booking System to 28.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
Product
Estatik Real Estate
Fixed in
4.3.5
What to do
Update Estatik Real Estate to 4.3.5 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Save as PDF Plugin by PDFCrowd: Arbitrary Function InvocationCVE-2026-92807 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Save as PDF Plugin by PDFCrowd plugin for WordPress is vulnerable to Arbitrary Function Invocation in all versions up to, and including, 4.6.1 via the `pdf_created_callback` shortcode attribute. The `eval_shortcode()` function copies any non-`button_`/non-`email_` shortcode attribute verbatim into a custom options array without sanitization, allowlist enforcement, or capability checks, and `create_button()` AES-encrypts that array — including the attacker-supplied callback value — and embeds the resulting blob in the rendered button HTML; when the blob is later POSTed to the unauthenticated `wp_ajax_nopriv_save_as_pdf_pdfcrowd` endpoint, `save_as_pdf_pdfcrowd()` decrypts it and invokes `$options['pdf_created_callback']` as a PHP callable at line 1722 with no `is_callable()` guard, no allowlist, and no capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to invoke arbitrary PHP functions or static class methods with plugin option data as the sole argument, enabling disclosure of the site's stored PDFCrowd API key and username or further server-side abuse. Note that the encryption boundary does not mitigate this vector bec
Product
Save as PDF Plugin by PDFCrowd
Affected
up to 4.6.1
What to do
Affects up to 4.6.1. Update Save as PDF Plugin by PDFCrowd to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Sep 18, 2026Location Manager: Generic SQL InjectionCVE-2026-85705 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection is triggered when the orderby=lat_lon parameter is supplied, and affects multiple publicly accessible REST endpoints including geodir/v2/locations/cities, /regions, /countries, and /neighbourhoods via both the get_locations() and get_neighbourhoods() functions.
Product
Location Manager
Affected
up to 2.3.38
What to do
Affects up to 2.3.38. Update Location Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpgeodirectory.com wordfence.com
Sep 18, 2026WP Multi Store Locator Pro: Generic SQL InjectionCVE-2026-15275 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The injection occurs in a numeric, unquoted SQL context, meaning WordPress's wp_magic_quotes() addslashes-based protection cannot neutralize the payload, and the AJAX handler is registered on wp_ajax_nopriv_make_search_request with no nonce or capability check, making it fully accessible without authentication.
Product
WP Multi Store Locator Pro
Affected
up to 4.5.1
What to do
Affects up to 4.5.1. Update WP Multi Store Locator Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codecanyon.net wordfence.com
Sep 18, 2026Easy Appointments: Does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied idCVE-2026-87966 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Product
Easy Appointments
Fixed in
4.0.2.2
What to do
Update Easy Appointments to 4.0.2.2 or newer.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87775 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Tz Weekly Radio Schedule: Does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87774 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Tz Weekly Radio Schedule
Affected
up to 1.8.1
What to do
Affects up to 1.8.1. Update Tz Weekly Radio Schedule to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Product Question and Answer: Does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated usersCVE-2026-87771 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Product Question and Answer
Affected
up to 1.1.0
What to do
Affects up to 1.1.0. Update Product Question and Answer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026Price Drop Alert for Woo Commerce: Does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87770 · WordPress plugins & themes · reported by WPScanHigh 8.6
The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
Price Drop Alert for Woo Commerce
Affected
up to 1.1
What to do
Affects up to 1.1. Update Price Drop Alert for Woo Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com
Sep 18, 2026wp shortcut link and advertisement baner: Does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated usersCVE-2026-87767 · WordPress plugins & themes · reported by WPScanHigh 8.6
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data from the database.
Product
wp shortcut link and advertisement baner
Affected
up to 1.2.0
What to do
Affects up to 1.2.0. Update wp shortcut link and advertisement baner to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.